TMA-SOPHOS-1.1.4

Ensure SSL server certificate for remote SSL VPN is configured correctly

HighLevel 2Manual reviewsophos

Description

The Certificate used to secure SSL VPN should satisfy the following criteria. It should be a valid certificate from a trusted source. In most cases this means a trusted Public Certificate Authority as remote sslvpn users may not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better. Reviewed in the Sophos Firewall web admin console (SFOS has no plain-text configuration export to audit offline).

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Verify that the certificate being used to secure the SSL VPN meets the criteria listed. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate' Ensure that a valid certificate is applied to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Ensure that a valid certificate is used for the SSL VPN Gateway.

How it is fixed

Fix method: Guidance or infrastructure patch

Create a CSR and install a certificate from a public CA. Navigate to 'System > Administration > Admin and User settings > Admin console and end-user interaction > Certificate'. Set a valid certificate to the User portal. Navigate to 'Configure > Remote Access VPN > SSL VPN > SSL VPN global settings > SSL server certificate'. Set a valid certificate for the SSL VPN Gateway.

Properties

Operating systems: Any
Tags: sophoscrypto
Reference: CIS Sophos Firewall v22 Benchmark v1.0.0 - 1.1.4 Ensure SSL server certificate for remote SSL VPN is configured correctly